Who protects reputation for the Bolibourgeoisie?

Update: This post had some effect in the world, including the disappearance of a bunch of websites. Sorry for dead links. More follow-up here.

Derwick Associates is a Bahamas Bermuda*-based electricity contractor that has had great success selling power plants to Venezuelan state-owned enterprises. Those efforts have attracted attention from the press and, most recently, from former US ambassador to Venezuela Otto Reich, who sued two principals of Derwick for alleged interference with business and racketeering, also accusing them of bribery in Venezuela.

Derwick is the beneficiary of an aggressive on-line reputation management campaign. If you search the internet for terms associated with the company, such as the names of the two principals Reich accused, “Pedro Trebbau Lopez” and “Leopoldo Alejandro Betancourt Lopez,” you will find very few news articles about them. Some search engines, including Bing and DuckDuckGo, give an entire first page of spurious results (see image in upper left). Most of the results are for pages obviously designed to obfuscate, throwing banal dust into the eyes of the search engine and leaving a casual searcher with the incorrect impression that there’s nothing to see here. On Google, the first six results are such fluff. Ironically, one of the first serious articles to appear in these searches is an exposé by blogger Alek Boyd about Derwick’s reputation management.

Everyone has a right to protect reputation online. And I don’t much care if someone wants to spend time and money filling websites with celebrity gossip, sex advice or technology news interspersed with the names of Derwick’s newsmakers. Sure, I could join in the existential pondering about the future of knowledge and the internet itself (and that is a very good article!), but the 3,000 words in this post need no padding. Instead, I invite you to follow me down a maze of on-line clues that for the first time connect a host of Venezuela corruption scandals and hint at the possibility that a highly regarded Venezuelan security consultant may be connected to an online defamation campaign and even to a pair of denial-of-service attacks on blogs.

Start at the beginning. Whoever is running Derwick’s protection campaign uses a broad range of websites, most of which are untraceable without a government warrant. The person puts the names of Trebbau, Betancourt and other Derwick leaders onto accounts on Facebook, Bligoo, Slideshare, Google+, Webeden, Twitpic, WordPress.com, Apsense, Skyrock, even the long-forgotten Tripod and the progressive petition site Change.org. He then fills those pages with banalities that sometimes include search terms like PDVSA or electricity, but never link back to the serious news articles about Derwick.

The protector submits innocuous-sounding comments to blogs and news websites, such as this one, on a site focused on bipolar disorder:

But the protector let slip his anonymity when he registered domain names related to characters in the Derwick drama. The first I noticed were these rather obvious ones, registered 17 January 2012:

leopoldoalejandrobetancourtlopez.com
pedrotrebbaulopez.com

Internet domain names are commercial products, and a buyer has to provide a working e-mail address. Mailing address and phone number don’t matter, but the e-mail address has to work, or the domain registration won’t go through.

Today, the domains are registered anonymously through GoDaddy, a wholesaler in Arizona. But until just a couple weeks ago, they were registered to info@domaincustodial.com.

Domaincustodial.com itself is anonymously registered. Another site, DominioEnCustodia.com, was taken down in the past two weeks (here’s a version rescued from Google Cache). It identified a bunch of other pages, most of which were also registered to info@domaincustodial.com.

So we have two Derwick pages and these random unused domains named for wealthy or famous Venezuelans on dominioencustodia.com. But there are more. All of these Derwick-related names were registered to the same e-mail address on the same day, according to records downloaded from DomainTools.com:

Whoever is behind that e-mail address is quite likely the person who is running this whole reputation management campaign.

But it wasn’t just Derwick. DomainTools makes it easy to find all domains registered to an e-mail address. Back in May, I got the list, with about 100 domain names. All were registered to the names of people or companies that have been in the news in Venezuela and who might want reputation protection. Some examples are pages related to Nervis Villalobos, Venezuela’s former deputy minister of energy. His name appeared in Cesar Batiz’s article, “La historia íntima de Derwick”. In that story, Batiz said Villalobos had flown alone on a jet belonging to Derwick. Reich, in his lawsuit, accused Villalobos of carrying a bribe offer from Derwick to Energy Minister Rafael Ramírez. info@domaincustodial.com registered sites related to his name, such as:

When we spoke a couple weeks ago, Villalobos denied having anyone doing reputation protection and denied any knowledge of websites related to his name.

There are a bunch of domain names related to scandals in the Venezuelan state of Bolivar. There were interrelated scams going on there. You can read about them in “English” here. Some domain names related to these cases were registered to info@domaincustodial.com on March 1 of this year:

In addition, sites related to the name Carlos Rodrigo Gonzalez Piazza were created in June, again registered to info@domaincustodial.com.

I previously had no idea that “El Yerno del Gobernador del Estado Bolivar” (the son-in-law of the Bolivar state governor) was somehow mixed up in these affairs. But for whatever reason, the person at DomainCustodial registered them all together. Not exactly what you want from a reputation management consultant, linking your name to other scandals.

Same thing with Gianfranco Rondon. Never heard of the guy, but there he is. Info@domaincustodial.com has:

gianfrancorondon.com, .net, .org, .info, .biz

Now, it gets even stranger. The name on all these domain registrations was Carlos Díaz. Months earlier, I was trying to look up Roberto Enrique Rincón, owner of Tradequip Services & Marine in Houston, and noticed a bunch of reputation management sites related to his name.

Ovarb Industrial is a Texas-registered company that made hundreds of millions of dollars of sales to PDVSA, Venezuela’s state oil company in 2010, during the first phase of Venezuela’s ongoing electricity crisis. Ovarb is a sister company of Tradequip Services & Marine, a company based in the northern suburbs of Houston that makes a majority of its sales to PDVSA. Tradequip has a Venezuelan company too, Tradequip CA.

Tradequip, Ovarb and Reliable Process and Instruments, along with a host of other companies, are controlled by the family of Roberto Enrique Rincón Fernández, a Venezuelan with a mansion in The Woodlands, Texas. His son, Jose Enrique Rincón Bravo is also a major player in the company. (Ovarb is Bravo backwards.) His son-in-law, Ottavio Cautilli, used to control Ovarb-related domain names. I think Humberto Roberto Bravo is Roberto’s brother-in-law.

Back in 2010, Ovarb’s company registration was in the name of a woman named Sara Curphy. She was listed as President on some legal documents and on the website. César Batiz, a reporter at El Mundo and Últimas Noticias in Caracas, pointed out Ovarb a couple years ago in his now-famous article, “PDVSA compró con sobreprecio.”) Another name in his article was Michael Baker, husband of Curphy, whose name also appeared in legal and corporate documents associated with some of the Rincóns’ companies. José Berti founded a company with José Roberto Rincón (and according to the now-defunct newspaper 6to Poder, Berti was also mixed up in some interesting business on his own).

So you see, those domain names, all registered the same day, all contain the names of people who know one other. If you map their relationships, you’ll see that they all pass through Roberto Rincon.

But wait, there’s more. On 27 August 2012, CarlosDomains1902@gmail.com registered domains related to Abraham Shiera. Shiera is a Venezuelan-Floridian businessman who runs companies that sell materials to PDVSA. (He also appears in that photo with Roberto Enrique Rincón.) He hasn’t been in the press much, other than kvetching about a rain delay at a tennis match. But there he is, along with his main companies, populating the list of Carlos Díaz’s domains:

Between info@DomainCustodial.com and CarlosDomains1902@gmail.com, we’re talking about 468 domains, according to domain DomainTools.com. (Feel free to donate the $299 so I can buy the whole list. Button is up there on the right.)

I hope you don’t mind if I go on. This thing is a sort of Rosetta stone of Venezuela weirdness.

A couple years ago, a Venezuelan company was accused of having handled kickbacks in a military procurement deal in Spain. The company was called Rebazve Holdings and was run by Juan Rafael Carvallo and Pedro Enrique Malave. Among Carlos’s domains:

And there’s Ramiro Helmeyer, convicted of murder and terrorism for his role in the 1993 “yuppie gang” bombings in Caracas. Others involved in the scheme always maintained there was some sort of framing involved, maybe involving drug traffickers. It would be an interesting story for someone to dig into. Anyway he was freed by Pres. Hugo Chávez — maybe pardoned, maybe paroled, hard to say, as someone has deleted all of his case records from the Venezuelan court website (quite a reputation management trick in itself). Carlos Díaz domains include:

At RamiroHelmeyer.net, you can see his declaration, alongside a photo of a Spanish consultant that is labeled “Ramiro Helmeyer.” He says, “I committed an error in the past, for which I took responsibility and I paid, while the truly guilty were never tried thanks to their accomplices in power at that moment in history. I am completely dedicated to remaking my life, without harming anyone. Take that as you will, it’s the truth.”

Mock these efforts if you like — damning news articles are still the first hits for the guy on Google. But over at Bing and other search engines, Helmeyer remains protected.

The list goes on, mostly minor newsmakers, mostly people who have been accused in the press but never tried or much less convicted of anything, and also some who, as far as I can tell, were victims of crime and probably got tired of having one nightmare night of violence take over their Google reputation forever.

I wondered, who is Carlos Díaz, and why is he doing this? There are several clues.

First of all, these protected names show up in the content of other sites registered to Carlos Díaz.

Look at BairesToday, a blog that just started posting in July, covering Buenos Aires news. Mixed in with the news and photos of pretty girls are these same names. Again here. (Update 29 August: Don’t bother clicking, site is gone)
You can barely see it at the bottom of that screenshot, but look at the Beyonce article — for no particular reason, it says “Pedro Trebbau Lopez.” Here, go see the original. (Update 29 August: Don’t bother clicking, site is gone)

These pages are designed to produce spurious hits for internet searches on the term “Pedro Trebbau Lopez.” And not just him. A bunch of names show up, and most of the names overlap with the list of domain names registered to Carlos Díaz. (The two names that appear most, however, are of women who don’t seem to have anything to do with anything. I suspect they work for the reputation protection company and probably don’t know much about the people they are protecting. Please don’t make their lives miserable.) An example of these pages being used for reputation protection:

How does this hint at Carlos Díaz’s real identity? Well, first, there are several Venezuelan sites that are part of this whole charade:

They are all registered to Eduardo Aponte, with a phone number that’s almost identical to the non-functioning Caracas number of Carlos Díaz. (637-5494 x0212, rather than +58-212-637-5494). (Keep that name in mind — Eduardo Aponte.)

And then the clincher: I made a spreadsheet of all the domains that a month ago were registered to Domain Custodial. I sorted by creation date and saw that the oldest was first registered way back on 24 April 2009. The domain was CleanPerception.com.

We promote positive content and diminish negative information. We create positive content to position it in the [search] results. We strengthen existing positive and neutral information using the techniques of Search Engine Optimization Engineering. We promote the positioning of personal and corporate on-line assets such as blogs, forums, profiles, websites, etc.

Núñez’s full name is Rafael Eladio Núñez Aponte. His second name and second last name are awfully similar to Eduardo Aponte, who registered the .ve domains. And yes, if you search these domains, you may find scattered references to Rafael Núñez and his Enfoque Seguro website.

(“Rafa” also ran the hyperactive @enfoqueseguro Twitter stream until August 24, when it suddenly disappeared. I learned a lot about digital security from that stream and am sorry to see it go. UPDATE evening of 27 August, the Twitter stream is back with all its tweets. Good to see.)

Núñez denies any connection to Derwick or these websites. We spoke by phone August 5. Asked directly if he did any work for Derwick, he said no. Asked about Nervis Villalobos, he said, “Nerwis? Nerwis, quién es?”

“We work mostly with banks, the private sector,” he said. “We barely work with individuals, more with companies.” He said the company runs a compliance check on its clients to ensure that they appear on no “international lists.” “We don’t have links to people who don’t pass compliance check,” he said.

He says Clean Perception works with communications departments and offers strategies, but that his company lacks the manpower to run social media strategies for clients. “We do coaching, training,” he said.

“We have no connection with this Domain Custodial company,” he said, and asked what Domain Custodial was. I explained to him that his site, CleanPerception.com, was registered to Domain Custodial. He said that the technology department, “my technical guy,” was in charge of that and he didn’t know about it. He said he would look into it.

We spoke again the next day, and he said that Carlos Díaz was a web designer that Clean Perception had contracted to work on the site, and “we have nothing to do with him.” A person who worked at Clean Perception had a relation with him, but that person no longer works there. “No tengo ningún idea quien es este carajo.” The sites rafahacker and rafaelnunez? “Those domains aren’t mine,” he said. “Strange, no?” He asked me to send him screenshots of the domain registrations, and then said it was time for lunch and he would call me later. He didn’t. The next day, he deleted me from his Skype contacts. I e-mailed and asked for Díaz’s contact info and he sent an e-mail address and phone number. The phone didn’t connect and no one replied to e-mails sent to Díaz’s various addresses.

I find the denials implausible. Núñez is a recognized expert in digital security. I don’t believe he would give control over his company’s domain to someone he had never met. Redirecting a website to a new e-mail address generally requires approval from the old registrant. I wrote him with detailed questions explaining that I didn’t believe him. I said I think he is Carlos Díaz and Eduardo Aponte and that he is running reputation campaigns for Derwick and others. I asked once more how his company’s domain got into the hands of this Díaz person. He didn’t respond at all.

In a remarkable coincidence, in the weeks since I spoke with Núñez, dozens of “Carlos Díaz” domains have been re-registered to anonymous registration at GoDaddy.

Now, in case this situation isn’t already weird enough, let’s go further down the rabbit hole.

By coincidence, early this year, someone put Alfonzo’s full name into a bunch of porn pages. They are mostly gone now, but if you really search (which I don’t recommend) you can find some:

Interesting coincidence. Núñez has for years been heavily involved in the online fight against child porn. (He registered the domains for the Child Pornography Investigative Unit at cpiu.us and cpiu.es.) This reputation takedown tried to link its subject to pedophilia. No proof of anything here, just an interesting coincidence.

I reached Alfonzo and he said he couldn’t say anything at all about the lawsuit and that while there had been a defamation campaign, it was short-term, that after letters to websites it all disappeared, and he didn’t want to revisit the situation.

Aside from black-hat reputation management and black-hat reputation destruction, there’s also the possibility that Carlos Díaz has been involved in denial-of-service attacks.

A few weeks ago, I reported on Reich’s lawsuit. Alek Boyd, Derwick’s most persistent English-language critic, had at the time just opened a new website, infodio.com. He posted a bit about the new lawsuit. Then, his site was knocked offline by a distributed denial-of-service attack (DDoS).

When I mentioned to Núñez that this had happened, he immediately said that one couldn’t mount such an attack from Venezuela because of slow connections. Nice when people deny things before one can even ask a question. He also said he knows Boyd; Boyd denies this. I asked Núñez directly about the DDoS attacks in my follow-up e-mail August 11. As I said before, he didn’t respond.

Boyd has plenty of enemies and it may just be coincidence that the site was knocked offline that week. But then there’s this. His old site, vcrisis.org, was also once taken down by a DDoS attack. That happened after he refused to take down criticisms of Venezuelan businessman Majed Khalil. Wouldn’t you know, look at a few sites previously registered to info@domaincustodial.com:

majedkhalil.mobi, .me, .org, .info

And on other sites formerly registered to Díaz:

(Speaking of Boyd, he has also been a long-time critic of Antonio Mugica, CEO of voting machine maker Smartmatic. Yes, DomainCustodial:

To sum up, we have a reputation-management company sharing a domain registration e-mail with a whole bunch of reputation-management websites. Most of those sites appear to exist to protect people who have appeared in news articles about possible scandals. Critics of those same people have faced an on-line defamation campaign and at least two denial-of-service attacks. The person who runs the reputation management company is a convicted hacker who claims to have changed his ways. He declines to explain why he entrusted his company’s domain to someone he had never met. He also declines to explain why similar reputation-management websites are registered to Eduardo Aponte, a rare enough last name to make it a remarkable coincidence that it’s also his last name.

At the least, Núñez should probably clear the air. It’s possible that Carlos Díaz really exists. If so, Núñez (and/or Hernández) made a rookie error of digital security. But that would be the lesser error. Put me on the phone with Carlos. And if Clean Perception really is Carlos Díaz, why would Núñez put at risk his reputation, and that of his company?

Clean Perception has a slogan on its website: “Cuidamos tu reputación en linea como si fuera la nuestra.” Is it a promise or a warning?

I wasn’t really expecting a reply to my e-mail, and I don’t expect a reply to this post. I leave you with this quote from the 2002 book The Hacker Diaries:

Uhm.. is it possible that the “Carlos Díaz” might in fact be “LUIS Carlos Díaz” (@luiscarlos) a somewhat influential twitter user/blogger in the venezuelan political scene? Looking at this picture from the cleanperception website ( http://www.cleanperception.com/img/teamCP.jpg ) the guy speaking to the audience looks strikingly similar to him, also if you google “luis carlos diaz” + “eduardo aponte” bingo! they are related, both young UCAB graduate journalists who give talks on social media.

What people do for pay often goes against their beliefs. I cut material from this article, but if you want examples, check out the “friends” pages on Facebook for any of these protected people. Many link up with photos of little girls with big eyes, staring at cameras. Should we say that proves Núñez was uninvolved, as he struggles against child pornography?

Hi, I’m Luis Carlos Díaz. @LuisCarlos
I was contacted by the company Clean Perception to be its trainer in a single course for companies. That’s the photo of that activity and it’s from 2011.
I do not work for them and I am not the “Carlos Diaz” from domain records. In fact, this is a practice that I do not share and criticized in many of my columns. I posted something about it last weekend in Tal Cual.http://www.talcualdigital.com/Nota/visor.aspx?id=90971&tipo=AVA
Your post is pretty good.

Awesome investigation you have here. It should be published in venezuelan media… Try contacting some newspapers from here (I’m venezuelan) like El Nacional or 6to Poder to see if they publish it. Excuse my crappy english.

Thanks Miguel. Your English is better than mine, no worries. 6to Poder is out of business. El Nacional is paid off by Derwick, but sure, never hurts to try. It’s hard to condense this material to newspaper length. But maybe someone will try. It’s theirs, the information is free. Hopefully they will advance the story. There’s obviously a lot we don’t know.

This is a great piece of investigation that deserves maximum exposure. I will try (have to go on a trip soon) to put together a shortened version in Spanish. I will also send this one to several Washington-based think tanks: CATO, Heritage, Inter American Dialog, and to George Washington University, as a case they might want to use in some of the events. It would be nice to send it to the School of government of Harvard, where they structure CASES for the post graduate studies and I will try to get the address of Ricardo Haussman, who is at Harvard. This expose illustrates the difficulties of making headway in the fight for transparency in Venezuela’s financial Peyton Place. There is too much money used to protect the crooks.

Thanks Gustavo, very nice of you to say. I think you’re taking the right lesson from this — not that any one person was necessarily responsible, but that the system is now totally weighted in favour of opacity, with no counterweight providing transparency.

Among the mountain of black arts spawned by the most grand theft in the history of South America, aka the Bolivarian Republic of Venezuela and its Boligarch mafia, the web spun in the web is by far the nastiest. This magnificent piece of research begins to lift the face mask off a few of the maggots feasting on the cocaine oil and terror which makes their day. My hats off to the authors and again to Alec Boyd, a real patriot fighting in the trenches of the Internet. I will do whatever I can to get this post read.

I thought for the previous Alek reporting that FTI Consulting also offered this service to prominent boliburgueses. Not long time ago, if you try to compile some info about Moris Beracha, all what you would find was this PR garbage. But he maybe stop paying the monthly fee, now google returns all the shady activities of this guy

Yes, Alek’s comments about FTI appear to be well founded. I make a point in this post of not saying that Derwick is paying for this work. I have no idea who is ultimately behind it.

Beracha had a different consultant. They didn’t do this sort of stuff with fake Facebook pages and all. They just put up a bunch of domains giving Beracha’s resume and his side of the story. That’s a bit annoying to those who are searching for scandals, but at least it’s not about throwing deceptive dust in anyone’s eyes.

Kudos on as good a piece of investigative reporting as I’ve seen.
Too bad our papers don’t do much of it here in the USA.
Your research shows that a smart enough specialist can effectively fool the Google algorithms to flush undesired information way down the queue.
There are lots of people in the US and elsewhere who would be in the market for this kind of service. For instance, US Sen. Santorum would probably have been interested, even if only to derail an on line slander campaign. There is a real business opportunity here, providing a reliable appearance buffing service.

This is an awesome job investigative reporting. I would like to use this material for an article about how public opinion is manipulated by careful insertions of information into the mainstream media to alter the narrative and by misdirection in the internet. May I have your permission to re-blog this (giving you full credit) on PolicyMic, a U.S. based political blog?

Setty, great work, will tweet to people at Google, they should be interested to know this. They are always trying to improve their algorithm to avoid black hat SEO practices… We should all do the same and maybe it will make their “work” more difficult

They took a paid advertisement defending Derwick. That’s no big deal, I prefer that newspapers not discriminate against specific advertisers. But rather than running it in the print edition and letting that be the end of it, as with all other advertisements, they also ran this as a news story in the society pages. It goes after César Batiz and Alek Boyd, who are two reporters who were looking into Derwick. Rather than defending their colleagues, El Nacional accepted money and put this piece of garbage on the web. It’s still there, posing as a news story. Until that’s gone — or at least moved to the “letters to the editor,” rather than the news pages — I wouldn’t pitch a story to El Nacional.

The Derwick Associates Wikipedia article got involved in this as well. On January 17, there was an Elance advertisement for someone to fix a Wikipedia article that they claimed was being used for defamation. https://www.elance.com/j/wikipedia-editor-administrator-needed/36939614/ Although it is hard to be sure, the company who placed the advertisement appear to be the UK based Somermedia. The Elancer hired then tried to remove all negative material from the Derwick Associates article on Wikipedia and to have it deleted. During the deletion discussion three other Elancers were hired and at least two voted to delete the article.

Most of the negative information was eventually removed after the original hire kept pushing until it was taken out, even though the article wasn’t deleted.

the latest finding on this subject, enfoqueseguro uses the services of crowdflower to generate thousands of hits into this bogus sites and stupid press releases in order to “sink” real scandal hit results in the hits queque of google. it is to confirm that crowdflower is aware of the ethical weight of the tasks they re giving to the contributors that they claim to be more than 5 milion. Among others crowflower include in the tasks : roberto rincon, omar farias luces, majed khalil, juan carlos escotet rodriguez, gianfranco rondon, eduardo fernandez pineda, abraham shiera a question arises: why they need to hide some hits results from google search engine? clearly they have something to hide

Why I’m here

I'm Steven Bodzin, a reporter and investigator. I have lived in Chile, Venezuela, and Canada, and am now working at REDD Intelligence in New York. You can see my paid work here. I continue to follow South America and I'm especially interested in corruption in the energy industry. Here, I share some of the sights, experiences and half-baked thoughts that I am not sure I'll ever get paid to publish, or little leads that might help attract new sources. If you know more about any of these stories, please share. You can contact me at settysoutham@gmail.com.